Local privilege escalation via stale mm_struct pointer

Use-after-free in the AMD XDNA job scheduler in Linux allows local users to escalate privileges through the AMDXDNA_EXEC_CMD ioctl. amdxdna_cmd_submit stores current->mm in job->mm without taking a structural reference, so the scheduler worker can dereference a freed mm_struct. Exploitation requires low-privileged access to an AMD NPU accel render node and control of the submission race; consequences include kernel-memory disclosure, controlled writes, privilege escalation, or a panic.